Linux Filesystem Use % Discrepancy

Reposting this in the SAM forum, though it is more NPM, but I got no thoughts over there.

I'm noticing a discrepancy between the use% seen in Orion on our Linux servers and what the OS reports via df.

This morning we had a filesystem fill up, impacting an application, and the OS reported it was 100% full. Orion at the time reported 94.9% full, just below our alerting threshold of 95%. So we didn't know until the application stopped functioning.

Anyone know where Orion is pulling this information from and why it may be different from what the OS is actively reporting? Clearly we've lowered the threshold in this case, but trying to understand why we have this discrepancy.